X5000R Firmware
Approved changes feed: RSS · Atom
cpe:2.3:o:totolink:x5000r_firmware:*:*:*:*:*:*:*:*
part: o version: * update: *
| Vendor | Totolink (fa0129e6-aa24-5784-be77-22d8becdb79b) |
|---|---|
| Product | X5000R Firmware (ed2fe159-ed72-562e-9201-6283d6e50b7f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-15204 |
vulnerable | 2026-07-29 00:26:17.894460 |
TOTOLINK X5000R OpenVPN Export cstecgi.cgi exportOvpn path traversal
MEDIUM (5.3)
A vulnerability was detected in TOTOLINK X5000R 9.1.0cu.2415_B20250515/9.1.0cu.2350_B20230313. Affected by this vulnerability is the function exportOvpn of the file /web/cgi-bin/cstecgi.cgi of the component OpenVPN Export. The manipulation results in path traversal. The attack may be launched remotely.
Published: 2026-07-09T17:45:10.075Z
Updated: 2026-07-14T01:07:22.744Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-8137 |
vulnerable | 2026-06-08 08:08:58.139428 |
Totolink X5000R formDdns sub_458E40 buffer overflow
HIGH (8.8)
A vulnerability has been found in Totolink X5000R 9.1.0u.6369_B20230113. This vulnerability affects the function sub_458E40 of the file /boafrm/formDdns. The manipulation of the argument submit-url leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
Published: 2026-05-08T04:00:13.042Z
Updated: 2026-05-08T12:55:48.365Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-14586 |
vulnerable | 2026-06-08 07:06:34.773364 |
TOTOLINK X5000R cstecgi.cgi snprintf os command injection
MEDIUM (6.3)
A vulnerability was determined in TOTOLINK X5000R 9.1.0cu.2089_B20211224. Affected by this issue is the function snprintf of the file /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user. This manipulation of the argument User causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
Published: 2025-12-13T06:32:10.624Z
Updated: 2026-02-24T05:48:28.365Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-42744 |
vulnerable | 2026-06-08 06:45:46.922856 |
Details available
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setModifyVpnUser. Authenticated Attackers can send malicious packet to execute arbitrary commands.
Published: 2024-08-12T00:00:00.000Z
Updated: 2024-08-15T14:49:27.259Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-32350 |
vulnerable | 2026-06-08 06:35:33.077844 |
Details available
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "ipsecPsk" parameter in the "cstecgi.cgi" binary.
Published: 2024-05-14T15:55:10.699Z
Updated: 2025-02-13T15:48:03.486Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.